AWS costs: GuardDuty/Inspector/Security Hub - the full security bill on one page

GuardDuty, Inspector, and Security Hub still bill separately in most AWS accounts, but as of the current Security Hub pricing model, turning Security Hub on can absorb your entire Amazon Inspector bill into one per-resource charge — while leaving most of GuardDuty's protection plans billed exactly as before. That is the opposite of what almost every "here's what these three cost" article assumes, and it is the single most expensive misunderstanding in this whole corner of AWS billing.

What you're actually paying for, in plain terms

Jake runs a small phone repair shop with a side business selling refurbished handsets online. His store's booking site and inventory system live on six EC2 instances, a couple of Lambda functions that email receipts, and a Docker image or two in Elastic Container Registry (ECR). Nothing fancy. But a "secure your AWS account" checklist he found told him to turn on GuardDuty, Inspector, and Security Hub, in that order, in every region.

Three weeks later his AWS bill had a new $340 line item he didn't recognize, split across three different services, and none of the console pages agreed with each other about what he was paying for.

That's a normal experience, because these three services aren't one product with one price list. They're three separate services that happen to feed into each other:

• Amazon GuardDuty is a threat detection service. It watches CloudTrail logs, network traffic (VPC Flow Logs), DNS queries, and a handful of other signals for behavior that looks like an active attack — a compromised access key making unusual API calls, an EC2 instance suddenly talking to a known bad IP, that kind of thing.
• Amazon Inspector is a vulnerability scanner. It doesn't watch for attacks in progress; it checks your EC2 instances, container images, and Lambda functions against a database of known software vulnerabilities (CVEs) and tells you what's out of date before someone exploits it.
• AWS Security Hub is the aggregator. It pulls findings from GuardDuty, Inspector, AWS Config, and dozens of partner tools into one place, runs its own configuration checks (Cloud Security Posture Management, or CSPM), and — this is the part that changed — now also bundles in a chunk of Inspector's job under its own pricing.

GuardDuty pricing, dimension by dimension

GuardDuty has no flat monthly fee and no minimum. It bills on the volume of data and events it analyzes, and it's split into two layers: foundational threat detection, which you can't turn off, and optional protection plans, which you enable individually.

Foundational threat detection (always on)

The moment you enable GuardDuty in a region, it starts analyzing two things it can't stop analyzing: CloudTrail management events (every API call that touches your account's control plane) and VPC Flow Logs plus DNS query logs (your network traffic). CloudTrail management event analysis is charged per 1 million events per month, prorated. VPC Flow Log and DNS query log analysis is charged per gigabyte per month, with volume discounts as you scale — the first 500 GB is billed at $1.00 per GB, the next 2,000 GB at $0.50 per GB, and usage beyond that drops further.

So a small account processing 40 million CloudTrail management events in a month, at $4.00 per million, pays $160 for that piece alone. A separate account generating 3,000 GB total of VPC Flow Logs and DNS query logs in a month works out to $1,625: the first 500 GB at $1.00, the next 2,000 GB at $0.50, and the last 500 GB at $0.25.

Protection plans (opt-in, and this is where bills get big)

GuardDuty automatically turns most protection plans on for new accounts, except Runtime Monitoring, which you have to enable yourself. Each one has its own billing metric:

Notice something about Runtime Monitoring: if you've got the agent deployed and active on an EC2 instance, GuardDuty stops charging you for VPC Flow Log analysis on that specific instance, because the runtime agent already gives it equivalent network telemetry. AWS doesn't want to charge twice for the same signal coming from two sources on the same box — which, as you'll see later, is exactly the principle Security Hub's newer pricing tries to apply across services and mostly succeeds at, with one sharp edge.

Amazon Inspector pricing, dimension by dimension

Inspector charges per workload scanned, prorated by how long that workload actually existed during the billing month. There's no minimum fee here either.

Here's how that adds up in practice. Ten EC2 instances running all month plus ten more launched partway through and active for 15 days come to $18.87 for the month: 10 × $1.258, plus 5 averaged instances (10 running half the month) × $1.258. A repository configured for continual ECR scanning with 500 images already sitting there and 1,000 new pushes, hit by 15 vulnerability-database rescans that month, comes to $315: $90 for the new pushes, $225 for rescanning all 1,500 images 15 times each at a penny apiece.

Security Hub: the pricing model that changed underneath everyone

This is the section most existing guides get out of date on, because Security Hub's pricing structure isn't the same shape it used to be. If you've read an older article describing Security Hub CSPM billed "per security check, per finding ingestion event, per rule evaluation" — that model still technically exists as a standalone page, but it is no longer what you get by default when you enable Security Hub.

How the Essentials plan actually counts your resources

Essentials pricing is anchored on the resource unit. An EC2 instance or an Azure/GCP/OCI virtual machine equals one full resource unit. Below that, AWS scales things down: 12 Lambda functions (or Azure Function Apps) equal one resource unit, 18 ECR container images (or Azure equivalents) equal one resource unit, and 125 IAM users or roles equal one resource unit. Everything else Security Hub monitors — network exposure findings, AI inventory, unused access findings, the security resource graph — rides along at no extra charge; only those four resource types actually drive the meter.

So an account with 500 EC2 instances, 5,000 Lambda functions, 2,000 container images, and 3,000 IAM users converts like this: 500 EC2 (500 units) + 5,000 Lambda ÷ 12 (417 units) + 2,000 ECR ÷ 18 (111 units) + 3,000 IAM ÷ 125 (24 units) = 1,052 resource units. At the published $3.75 per resource unit used in AWS's own worked examples, that's roughly $3,945 a month for Essentials alone, before any Threat Analytics add-on.

Threat Analytics: the GuardDuty-powered add-on

Threat Analytics sits on top of Essentials and cannot be enabled alone — you need Essentials first. It bills on CloudTrail management events ($4.00 per million, matching GuardDuty's own foundational rate) plus a blended security-data-processing charge that covers VPC Flow Logs, DNS query logs, S3 data events, and EKS audit logs together, at a published $0.55 per GB for the first tier of volume, dropping in successive tiers as volume grows. In AWS's own small-account example, 2 million CloudTrail events plus 800 GB of security data plus 500 monitored EC2 instances came to $2,323 for the month: $8 for events, $440 for the log data, and $1,875 for the resource-based security risk analytics portion.

The gap nobody's checklist warns you about

Here's the honest, unglamorous part almost no pricing overview spells out: Threat Analytics only replicates a slice of what GuardDuty does. It covers CloudTrail management events, S3 data events, VPC Flow Logs, DNS query logs, and EKS audit logs — the foundational layer plus S3 Protection and EKS Protection, roughly speaking. It does not cover Malware Protection (EC2, S3, or Backup), RDS Protection, Lambda Protection, or AI Protection. If your account uses any of those, they keep billing directly through GuardDuty, on top of whatever Security Hub charges you.

AWS states this plainly in its own FAQ: capabilities not explicitly listed inside a Security Hub plan continue to be billed through their original service. So a shop running GuardDuty's Malware Protection for S3 to catch infected uploads, plus Security Hub Essentials with Threat Analytics for everything else, gets two separate charges from two separate services on the same bill — and that's correct, working-as-designed behavior, not an error. The mistake is assuming Security Hub "replaces GuardDuty" wholesale. It replaces Inspector far more completely than it replaces GuardDuty.

This is close to what actually happened to Jake, once he pulled the itemized bill apart with Ethan on a call. Jake's checklist had told him to turn on GuardDuty's Malware Protection for S3 on the shop's upload bucket, where customers attach photos of damaged phones for repair quotes. Separately, the same checklist told him to enable Security Hub with Threat Analytics for general coverage. Malware Protection for S3 isn't part of Threat Analytics, so it kept billing through GuardDuty on its own small meter — a handful of dollars for the volume his shop pushes through that bucket — sitting right next to a second, separate Security Hub charge that felt, from the console, like it should have been "the same thing." Ethan's answer was blunt: "That's not a bug, and it's not a double charge for the same work. GuardDuty is still the only service actually scanning those uploads for malware — Security Hub just isn't the tool doing that job, no matter how much it looks like a catch-all from the billing page."

Three real-size worked examples

Jake's shop — one account, one region

Six EC2 instances, two Lambda functions, one ECR repository with a couple of images, no Security Hub, standalone GuardDuty foundational tier plus standalone Inspector:

• GuardDuty foundational (light CloudTrail volume, modest VPC Flow Log volume for a shop this size): commonly in the $10–$100/month range for an account this small, dominated by whichever log source has the most volume.
• Inspector: 6 EC2 × $1.258 = $7.55, 2 Lambda × $0.30 = $0.60, a couple of ECR images at $0.09 each on push. Call it under $10/month.

Jake's total security tooling bill for a shop this size, run this way, should land closer to double digits than to the $340 he actually saw — which tells you his bill spike wasn't from GuardDuty or Inspector at all. It was Security Hub, enabled in every region his account had ever touched, most of which had zero real workloads in them.

Mid-size shop — Security Hub Essentials, no Threat Analytics

Same resource mix as above but multiplied by roughly 30 for a busier operation: 180 EC2 instances, 60 Lambda functions, 30 container images. Converted to resource units: 180 + (60÷12=5) + (30÷18≈2) = 187 units. At $3.75/unit, that's roughly $701/month for Essentials — covering CSPM checks, EC2 and ECR and Lambda scanning, and CIS Benchmark assessments, all in one line.

Large organization — Essentials plus Threat Analytics

AWS's own published example: 100 million CloudTrail events, 500 TB of security log data, and a resource mix of 1,000 EC2 instances, 5,000 Lambda functions, 2,000 container images, and 3,000 IAM users comes to $61,774.99 for the month — $400 for the CloudTrail event volume, $53,000 for the tiered log-data processing (the vast majority of the bill, because 500 TB is enormous), and $8,374.99 for the 2,233 resource units at $3.75 each. At this scale, the security log data volume — not the resource count — is what drives the number, and that volume is the one lever worth working on first.

How to actually bring the number down

Work down this list in order — cheapest and least disruptive first.

1. Run the Security Hub Cost Estimator before enabling anything. It's a console feature that reads your existing GuardDuty, Inspector, and Security Hub CSPM usage and projects both your current individual-service cost and what Essentials/Threat Analytics would cost instead, side by side. It does not include Extended plan partner pricing, so treat the comparison as core-service-only.
2. Check for overlap before you flip Security Hub on. If standalone Inspector is already enabled and configured for EC2, ECR, or Lambda scanning in that account, decide up front whether you're keeping it standalone or letting Essentials absorb it — don't run both against the same resources.
3. Disable GuardDuty and Inspector in regions you don't actually use. A "just in case, enable everywhere" default policy is the single most common source of unexplained charges on small accounts, because CloudTrail management event analysis bills you a small amount even in a region with nothing running.
4. Scope Malware Protection and RDS Protection to workloads that need them, rather than organization-wide, since neither is covered by Security Hub's Threat Analytics add-on and both keep billing through GuardDuty regardless of what else you enable.
5. Watch container image rescanning if you're on continual ECR scanning. A large, rarely-updated repository racks up rescan charges every time the vulnerability database updates, even if nobody pushed a new image. Switching to on-push-only scanning removes that meter entirely, at the cost of not catching newly disclosed vulnerabilities in images you already pushed.
6. At real scale, security log data volume dominates the bill — not resource count. Trimming unnecessary VPC Flow Log or CloudTrail data event sources (accounts logging data events they never query) does more for a large org's Threat Analytics bill than trimming EC2 instance count ever will.

Jake asked Ethan the obvious follow-up once he saw that list: "Could I just turn everything off and only flip it back on when something actually goes wrong?" Ethan didn't hedge on that one: "No — and that's the one shortcut I'd talk anyone out of. Foundational GuardDuty detection and basic vulnerability scanning are cheap enough that 'disable it to save money' almost never pencils out once you weigh it against what one missed compromised key or one unpatched instance actually costs you. Trim the protection plans and the regions you don't need. Don't trim the baseline."

Multi-account organizations: it's a per-account switch, not an org-wide one

Security Hub's streamlined pricing is decided account by account. Enable Security Hub in a given account, and that account gets the streamlined resource-unit model for the capabilities it covers. Leave Security Hub disabled in a sibling account, and that account keeps paying individual GuardDuty, Inspector, and Security Hub CSPM rates. Within a single AWS Organization, it is entirely normal — and supported — to have some accounts on one model and some on the other, determined purely by whether Security Hub is switched on in that specific account.

Picture a small agency running two AWS accounts under one Organization: a production account carrying 220 long-running EC2 instances behind a handful of client sites, and a shared sandbox account where developers spin up and tear down Lambda functions constantly, rarely running more than a dozen at once with almost no persistent EC2 footprint. Enabling Security Hub Essentials in the production account makes sense — 220 resource units at $3.75 comes to roughly $825/month, covering CSPM, vulnerability scanning, and unlimited compliance checks in one line, a fair trade for an account that gets audited regularly. Enabling the same plan in the sandbox account, where the resource count barely clears a handful of units most months, would mean paying for compliance tooling nobody there uses. Leaving that account on standalone Inspector, or skipping vulnerability scanning there and relying on the org's central GuardDuty coverage, is the more defensible call. Nothing about AWS Organizations forces the same choice twice.

1. Decide per account, not per organization. A dev/sandbox account with a handful of short-lived Lambda functions may do better on individual Inspector pricing than on Essentials' resource-unit floor. A production account with hundreds of long-running EC2 instances usually does better consolidated.
2. Use a delegated administrator account to see the whole picture. Security Hub's central administrator account can aggregate findings and estimated organization-wide spend, so you're not stitching together bills from a dozen member accounts by hand.
3. Re-run the cost estimator per account as workloads shift. An account that made sense on individual pricing at launch can flip the other way six months later once its instance count or Lambda footprint grows.

Edge cases: containers, Lambda, and multicloud

A few situations deserve their own line, because they don't fit the simple per-resource math cleanly.

Container images that get re-monitored, not just re-pushed. Under Security Hub's coverage rules, an ECR image can accumulate charges based on how long it stays "in scope" for monitoring — governed by push date, pull date, and last-in-use date, whichever window you've configured — not simply whether it exists in the repository. An image that gets deployed and redeployed across ECS or EKS clusters repeatedly can rack up more monitored time than a static image sitting untouched. That distinction matters more than it looks: two shops with identical repository sizes can land on very different monthly totals purely because of how often their existing images get redeployed rather than rebuilt, since redeployment resets the monitoring clock on an image that would otherwise have aged out of the charge window.

Lambda functions that don't get billed at all. Both Inspector's standard scanning and Security Hub's Essentials plan only count Lambda functions marked $LATEST that were invoked or updated in the last 90 days. A function you deployed once, never touched again, and never invoked drops out of the billing calculation over time — which is one of the few places this whole system quietly saves you money on its own.

Azure and multicloud coverage. Once you integrate Microsoft Azure with GuardDuty, Inspector, or Security Hub, Azure resources get their own independent 30-day free trial, separate from whatever trial status your AWS resources are in. Azure VMs price the same as EC2 instances ($1.258/mo standalone, 1 resource unit under Essentials); Azure Function Apps match Lambda standard scanning rates; Azure Container Registry images match ECR rates.

When staying on standalone services is genuinely the better call

Ethan's take: "People treat 'consolidated' as automatically cheaper, and it isn't — it's a different shape of bill. If your resource mix happens to sit right on top of Essentials' resource-unit assumptions, you win. If it's mostly small, short-lived Lambda functions or you don't care about compliance checks at all, standalone Inspector can genuinely be the cheaper, simpler option. Run the actual numbers for your account instead of assuming the newer pricing model is the better one by default."

Free trials, and where they don't apply

All three services offer trials, but the exceptions matter more than the headline number:

• GuardDuty: 30-day free trial per account per region, covering foundational detection and available protection plans. On-demand malware scanning and Malware Protection for S3 are exceptions — the former has no trial at all, the latter has a perpetual free tier (1,000 requests + 1 GB/month) instead of a time-limited trial.
• Inspector: 15-day free trial covering EC2, Lambda, ECR, and code repository scanning. CIS Benchmark assessments are excluded from the trial. On-demand CI/CD image scanning gets a one-time allowance of 25 free image assessments per account, separate from the 15-day window.
• Security Hub Essentials: 30-day free trial per account per region, and you remain eligible even if you already burned through an Inspector or Security Hub CSPM trial previously. Threat Analytics, Lambda Code Scanning, and the Extended plan are not covered by this trial, though the underlying GuardDuty/Inspector trials still apply if you haven't used them.

One detail worth flagging for anyone running more than one AWS region: because GuardDuty's trial is granted per account per region, and Security Hub's Essentials trial follows the same logic, turning either service on in a new region for the first time resets that clock only for the new region. It doesn't extend or renew a trial that already expired somewhere else. A team that burned through its GuardDuty trial in one region months ago still gets a fresh 30 days the first time it enables GuardDuty in a region it hasn't touched before — worth knowing before you assume a "trial expired" notice on one region applies to the whole account.

The Extended plan: worth knowing about, rarely relevant to this bill

Security Hub also offers an Extended plan: curated third-party partner solutions across categories like endpoint protection, identity, email security, and browser security, purchasable through the Security Hub console on a single AWS bill, eligible toward Private Pricing Agreement or Enterprise Discount Program commitments. This requires Essentials as a prerequisite and is priced entirely per-partner, with each solution using its own dimension — per endpoint, per user, per TB, per token. For a shop the size of Jake's, this tier isn't relevant; it exists for organizations already buying tools like CrowdStrike or Okta separately and wanting one consolidated invoice instead of many.

Frequently asked questions

How much does AWS GuardDuty cost per month?

There's no flat fee. You pay for CloudTrail management event analysis (per million events), VPC Flow Log and DNS query log analysis (per GB, discounted with volume), and separately for any protection plans you enable (S3, EKS, Malware Protection, RDS Protection, Runtime Monitoring, Lambda Protection, AI Protection). A small single-account setup commonly lands in the $10–$100/month range; large multi-account organizations running every protection plan can run into the thousands.

How much does Amazon Inspector cost per month?

Roughly $1.258 per EC2 instance scanned with the SSM agent, $1.75 per instance scanned agentlessly, $0.09 per new container image pushed to ECR, $0.01 per rescan, and $0.30 per Lambda function on standard scanning ($0.90 if you add code scanning). Charges are prorated for partial months, so a workload that only existed for two weeks costs roughly half the monthly rate.

How much does AWS Security Hub cost now that pricing changed?

Security Hub's default coverage is now the Essentials plan, priced per resource unit per month (EC2 instances count as 1 unit, with Lambda, ECR, and IAM converted at 12:1, 18:1, and 125:1 respectively). A mid-size account with roughly 190 combined resource units lands around $700/month for Essentials alone. Adding the Threat Analytics add-on brings in GuardDuty-powered detection billed separately on CloudTrail event and log data volume.

Do I need GuardDuty, Inspector, and Security Hub all at once?

Not necessarily, and not necessarily as three separate bills. GuardDuty detects active threats, Inspector finds unpatched vulnerabilities, and Security Hub aggregates and (as of the current pricing model) partially absorbs Inspector's job. A minimal, defensible setup for a small account is GuardDuty's foundational tier plus either standalone Inspector or Security Hub Essentials — not necessarily both, and not necessarily every protection plan.

Does enabling Security Hub turn off my Amazon Inspector billing?

No, not automatically. Security Hub's Essentials plan includes EC2, ECR, and Lambda standard scanning capabilities equivalent to Inspector's, but if you leave standalone Inspector separately enabled and configured on the same resources, you will likely be charged for both. You need to deliberately decide which one is doing the scanning for that account.

What happens to GuardDuty billing when I turn on Security Hub Threat Analytics?

Threat Analytics covers CloudTrail management events, S3 data events, VPC Flow Logs, DNS query logs, and EKS audit logs under Security Hub's pricing instead of GuardDuty's. But GuardDuty's Malware Protection, RDS Protection, Lambda Protection, and AI Protection are not included in Threat Analytics and keep billing directly through GuardDuty if you have them enabled.

Is there a free trial for GuardDuty, Inspector, and Security Hub?

Yes for all three: GuardDuty and Security Hub Essentials each offer 30 days, Inspector offers 15 days. Exceptions exist in each: GuardDuty's on-demand malware scanning has no trial at all, Inspector's CIS Benchmark assessments are excluded from its trial, and Security Hub's Threat Analytics and Extended plan add-ons aren't covered by the Essentials trial.

What counts as a "resource unit" in the Security Hub Essentials plan?

One EC2 instance, Azure VM, GCP VM, OCI VM, or on-premises VM/bare-metal server equals one resource unit. Twelve Lambda functions or Azure Function Apps equal one unit. Eighteen ECR or Azure container images equal one unit. One hundred twenty-five IAM users or roles equal one unit. Only these four resource types drive per-unit pricing; everything else Security Hub monitors is included at no extra charge.

Can I use Amazon Inspector without Security Hub?

Yes. Inspector remains fully available as a standalone service with its own pricing, whether or not Security Hub is enabled in that account. Individual services like Inspector, GuardDuty, and standalone Security Hub CSPM continue to work with their original pricing when Security Hub streamlined pricing isn't enabled for that account.

Why did my GuardDuty bill spike after I enabled it across all AWS regions?

CloudTrail management event analysis charges apply the moment GuardDuty is active in a region, even one with no real workloads — some baseline account and control-plane activity still gets analyzed. Enabling GuardDuty in every available region "just in case" is one of the most common sources of small, hard-to-explain charges on otherwise minimal accounts.

Does Security Hub charge separately for CIS Benchmark assessments?

Not under the Essentials plan — unlimited CIS Benchmark assessments are included in the per-resource-unit price. Under standalone Amazon Inspector, they're billed separately at $0.03 per assessment per instance and are excluded from Inspector's free trial.

What is the difference between Security Hub Essentials and Security Hub CSPM?

Security Hub CSPM was (and, as a standalone page, technically still is) priced on security checks, finding ingestion events, and automation rule evaluations — a usage-based model. Essentials replaces that experience with unified per-resource-unit pricing that also folds in Inspector's EC2, ECR, and Lambda scanning plus CIS Benchmark assessments, trading usage-based billing for resource-based billing.

How does Security Hub pricing work across an AWS Organization with many accounts?

Pricing is decided at the account level, not organization-wide. Enabling Security Hub in a specific account gives that account streamlined pricing for the capabilities it covers; accounts where Security Hub isn't enabled keep using individual GuardDuty, Inspector, and Security Hub CSPM pricing. Mixed pricing models across accounts within the same organization is normal and supported.

Does GuardDuty Malware Protection cost extra on top of the base GuardDuty price?

Yes. Malware Protection for EC2 charges $0.03 per GB of EBS data scanned plus a separate EBS snapshot storage cost. Malware Protection for S3 charges $0.09 per GB scanned plus $0.215 per 1,000 objects evaluated, with a perpetual free tier of 1,000 requests and 1 GB per month. Malware Protection for AWS Backup charges $0.05 per GB scanned, on top of your existing AWS Backup storage costs, and has no free trial or free tier at all.

What is the Security Hub Extended plan and do I need it?

The Extended plan is a marketplace of curated third-party security partners (endpoint protection, identity, email, network, data, browser, AI, security operations, and supply chain tools) billed through a single AWS invoice on top of Essentials. Most small and mid-size accounts don't need it; it's aimed at organizations already buying tools like CrowdStrike, Okta, or Splunk separately who want consolidated billing and PPA/EDP eligibility.

How can I estimate my AWS security costs before turning anything on?

Use the Security Hub Cost Estimator in the console, accessible from the Security Hub landing page, from GuardDuty or Inspector consoles, or during Security Hub's onboarding flow. It analyzes your current usage and projects both individual-service pricing and Essentials/Threat Analytics pricing side by side, though it doesn't include Extended plan partner pricing.

Revision note. Written September 2026, covering the current Security Hub Essentials/Threat Analytics/Extended plan structure alongside standalone GuardDuty and Amazon Inspector pricing. This will need a revisit if AWS changes the resource-unit conversion rates or expands what Threat Analytics covers. If you're staring at a bill that doesn't match anything in your dashboard, you're not missing something obvious — this genuinely is one of the more tangled corners of AWS pricing, and it's worth the twenty minutes it takes to sort out.